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ATD-1 Avionics Phase 2 
Flight Test using Honeywell and United Airlines Aircraft 


Program Overview 


The Air Traffic Management Technology Demonstration-1 (ATD-1) is a major applied 
research and development activity of NASA’s Airspace Operations and Safety Program 
(AOSP). The demonstration is the first of an envisioned series of Air Traffic 
Management (ATM) Technology Demonstration sub-projects that will demonstrate 
innovative NASA technologies that have attained a sufficient level of maturity to merit 
more in-depth research and evaluation at the system level in relevant environments. 


Program Objectives and General Description 


The overall goal of ATD1 is the operational demonstration of an integrated set of NASA 
arrival management technologies for planning and executing efficient arrival operations 
in the terminal environment of a high-density airport. Specifically, for this flight test, the 
two sub-goals are as follows: 
1) Develop avionics hardware and a FIM application that provides the automation 
required for FIM operations 
2) Integrate FIM avionics into two test aircraft and conduct validation flight tests 


The ATD-1 demonstration, scheduled for 2017, will include flight trials with multiple 
aircraft equipped with prototype avionics supporting FIM operations. 


Project Management 


The Project and flight test management members of the team are as follows: 


Beoing Project Manager: ATD1 Flight Test Director: 

Karl Rein- Weston Dan Boyle 

Seattle, WA Seattle, WA 

(206) 200-2312 (425) 266-0787 

Karl.J.Rein-Weston @ Boeing.com Daniel.A.Boyle@ Boeing.com 
Honeywell Project Manager: Honeywell Lead Test Pilot and FSO: 
Rick Berckfeldt Helmuth Eggeling 

Olathe, KS Phoenix, AZ 

(480) 444-3506 (602) 231-2697 

Rick.Berckefeldt@ Honyewell.com Helmuth.Eggeling @ Honeywell.com 
United Airlines Project Manager: United Airlines Flight Test Captain: 
Craig Stankiewicz George Silverman 

Chicago, IL San Francisco, CA 

(872) 825-9110 (650) 315-0045 
Craig.Stankiewicz@ United.com George.Silverman @ United.com 
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NASA Project Manager: 
William Johnson 

NASA LaRC, Hampton, VA 
(757) 864-3858 
William.Johnson @ nasa.gov 


NASA Flight Test Lead: 
Brian Baxley 

NASA LaRC, Hampton, VA 
(757) 864-7317 
Brian.T.Baxley@nasa.gov 


NASA Technical Point of Contact for the 


Statement of Work: 

Denise Scearce 

NASA LaRC, Hampton, VA 
(757) 864-1864 
Denise.K.Scearce @nasa.gov 


technology (DO-260B compliant). Its operating characteristics and functionality 


capability, GNSS equipage, and capable of LNAV/VNAV, RNAV, and RNP AR. 


The alternative or back-up is a transport (non-research) Falcon 900 or an Embraer 
170. Each will have the same avionics capabilities as the primary target aircraft. 


The first FIM aircraft will be the Honeywell 757 test aircraft that will be equipped 
with DO-260B-compliant ADS-B Out and In technology, and the FIM Avionics 


1.3 Selected Aircraft 
All aircraft used as part of this contract will be operated under that contractor’s FAR Part 
91 approval, and will be flown by that contractor’s flight crews, who will be qualified 
and current in that aircraft for all operations to be performed. Two of the aircraft will be 
flown under Experimental certificates due to the installation of prototype FIM equipment 
and software. 
1.3.1 Target aircraft (Honeywell Dassault 900) 
The research or business transport aircraft is equipped with ADS-B Out 
are similar to commercial transport category aircraft, and include full IFR 
More details will be provided if this option becomes primary. 
1.3.2 FIM aircraft #1 (Honeywell Boeing 757) 
System running the FIM application. The aircraft is a commercial transport 
category aircraft permanently utilized in the flight test role; its operational 
capabilities include full IFR, GNSS equipage, and LNAV/VNAV, RNAV, and 
RNP AR performance. 
1.3.3. FIM aircraft #2 (United Airlines Boeing 737) 
REV NEW D780-10413-1 
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The second FIM aircraft is a United Airlines (UAL) Boeing 737-900 that will be 
equipped with DO-260B-compliant ADS-B Out and In technology, and the FIM 
Avionics System running the FIM application. It is a standard production revenue 
aircraft which will be modified for this flight test with FIM and additional data- 
gathering equipment (engineering work station). Like the 757, its operational 
capabilities include full IFR, GNSS equipage, and LNAV/VNAV, RNAV, and 
RNP AR performance. 


1.4 Proposed Aircraft Modifications and Design Criteria 


The Honeywell aircraft are maintained in accordance with the FAA approved Honeywell 
Flight Operations Maintenance Inspection Program Manual, per 14CFR 91.409 (e) (f) 

(4). All modifications are performed by an FAA approved repair facility and follow a 
100% buyback process. The Required Inspection Item (RII) allows someone to do the 
work and inspect it, with a second person inspecting the work. The Honeywell aircraft are 
maintained, and the modification work performed, at the Honeywell repair station in 
Phoenix (AV4R064M). 


The United Airlines aircraft is also maintained in accordance with their FAA approved 
procedures, and all modifications to the aircraft also use the RI process and will be 
performed in their FAA approved repair facility in Denver (CALAO14). 


The majority of the hardware used in this flight test is existing, FAA certified hardware. 
Some hardware will be installed specifically for the flight test, and then removed after the 
flight test to return the aircraft to its original configuration. Portions of the software are 
prototype, and these have been developed in preparation for certification for commercial 
use (TPU and transponder) or based on NASA’s design (FIM avionics system). 


The ATD-1 Avionics Phase 2 software assurance representative evaluated this activity 
per NPR 7150.2 and classified the software components for this Project as Class D (Basic 
Science/Engineering Design and Research and Technology Software; failure of the 
research system results in a minor failure condition for the aircraft). This is documented 
in the official Software Assurance Classification Report. 
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The light blue boxes represent existing, certified systems that are included in the avionics 
suites of the FIM aircraft. The dark blue boxes are revised (Transponders and TPU) and 
additional systems. The transponder is DO-260B compliant and will be a unit that will 
enter airline service. The Traffic Processor Unit (TPU) replaces the TCAS unit and, as 
such, continues to provide TCAS functionality which is unaffected (regression testing 
carried out) by addition of the ASSAP function. The Aircraft Interface Device (AID) 
provides an interface with the Electronic Flight Bags, one of which, acting as master, 
runs the FIM application using target track data provided by the ASSAP function in the 


TPU. 


Of special significance is the fact that data flow will be one-way, from certified avionics 
to revised or FIM equipment. Within the FIM-specific functions, the only data that flow 
back from the FIM application running in the EFB to the TPU is identification of the 
designated target aircraft. This ensures that the designated target always remains 
available for display regardless of how many other targets are present. This will be 
validated during the System Acceptance Review scheduled for December 2016. 
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1.5 Instrumentation Hardware/Software and Flight Test Data Measurement 
Requirement 


All hardware and software is contractor developed, owned, and provided. The FIM 
avionics and prototype hardware and software will be delivered to NASA after the Flight 
Test is complete. 


There will be engineering stations in the form of laptop computers (provided by 
Honeywell) on board each of the FIM-equipped aircraft to record aircraft state data and 
FIM avionics data. No flight test data are required to be collected from the ground, 
although it may be possible to obtain flight track files from the FAA ATC facilities. 


Data from the aircraft’s FMS (QAR / FOQA) will be provided to NASA, and an 
audio/video recording of the Honeywell B-757 cockpit will also be provided to NASA. 


1.6 Contractual Requirements 


The NASA Task Order # NNLISAB46T (“ATD-1 Avionics, Phase 2”) has been issued 
for the period of 6/5/2015 to 6/4/2017 under the Flight Critical System Research contract 
#NNL13AA03B. (This document is also referred to as the Statement of Work, or SOW). 


This SOW requires the contractor to “obtain experimental type certificates for each type 
of aircraft” for equipping with the prototype avionics (SOW paragraph 3.6.1). However, 
since the target aircraft will not be equipped with prototype equipment, it will operate 
under its current certificate. The SOW also requires the contractor to “coordinate with 
aircraft operators and the FAA facilities to obtain flight test approvals” (SOW paragraph 
3.6.11). The operators are working with their regulatory authorities to obtain approvals, 
and Boeing has coordinated with the ATC facilities that will be affected to obtain their 
approval. In addition, Boeing has designed custom arrival procedures that have been 
approved by the FAA and published as Special STARs to allow flight test operations to 
be conducted under Instrument Flight Rules (IFR) (contract deliverable 4.22, Flight Test 
Plan). This approval process included provision of Letters of No Technical Objection by 
Seattle Center and Moses Lake TRACON managers. Should these STARs not be 
approved in time for the flight test, the mitigation plan is use an experimental version of 
that NDB that would be available for all three airplanes. 


1.7 Other Involved Agencies 
1.7.1 Boeing 


1.7.1.1 Boeing Research and Technology (BR&T) 
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Boeing Research & Technology (BR&T) is the prime contractor for the ATD-1 
Avionics Phase 2 contract. BR&T has been instrumental in the definition of the 
FIM operational concept, requirements, and minimum operating performance 
standards (MOPS). The company is actively involved in the evolution of the 
ARINC 735/735A/735B standards, in which TCAS/traffic computer aircraft 
integration requirements have been established for TCAS and ADS-B In 
applications, as well as addressing such issues as new TCAS logic and spectrum 
congestion as the industry moves closer to FIM operations in terminal airspace. 


1.7.1.2 Boeing Commercial Aircraft 


1.7.2 


1.7.3 


1.7.4 
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Boeing Commercial Aircraft (BCA) provides support through an Inter- 
organizational Work Transaction (IWT) contract, and is involved with developing 
the spacing algorithm, developing cockpit displays, installing hardware, and data 
gathering/analysis. 


Honeywell 


Honeywell is a direct sub-contractor to Boeing, and has an extensive background 
in avionics development, specifically Automatic Dependent Surveillance- 
Broadcast (ADS-B) and Cockpit Display of Traffic Information (CDTI) 
applications and flight management computer (FMC) research and technology 
development. Of particular relevance is Honeywell’s experience in developing 
and implementing the In-Trail Procedure (ITP) application on a fleet of 12 
operational UAL aircraft. The plan view traffic display application on the ITP 
platform is included in the FIM system developed for this project. 


United Airlines 


UAL 1s a direct sub-contractor to Boeing, and has direct experience integrating 
ADS-B In applications with EFB interfaces through participation in the FAA ITP 
trials with 12 operational 747-400s, and through early development of Version 2 
(DO-260-B) ADS-B Out technology, participating in the FAA Operational 
Benefits Validation project. UAL has also been influentially involved in 
associated industry standards and rule-making activities. 


Jeppesen 


Jeppesen is working under a Commercial Item Transfer at Price (CITAP) contract 
under the BCA IWT. It has provided navigation databases that will be loaded into 
the FMCs of the target aircraft and into the FMCs and FIM systems of the FIM- 
equipped aircraft. This database will be used by the aircrafts’ FMSs to access the 
customized arrival procedures (STARs) and standard published instrument 
approach procedures (IAPs) into KMWH. The FIM systems will access the 
database to acquire data required to accomplish trajectory prediction. The 


D780-10413-1 Page 13 of 52 


Q SOLING Honeywell bead 


UNITED 


databases will also be provided to NASA for use in simulations and to Honeywell 
for bench testing. 


1.8 Summary of Supporting Research and Tests 


1.8.1 


1.8.2 


1.8.3 


REV NEW 


Analytical 


Regression testing of the software will be conducted at Honeywell’s Redmond 
WA facility, and validated by the entire ATD-1 team during the System 
Acceptance Review in December 2016. Additional studies conducted and 
provided in the ATD-1 documents for: 

e hardware design, equipment interfaces, power required (deliverable 4.23) 

e software design, algorithm performance, logic (deliverable 4.4) 

e human-machine interface (deliverable 4.10) 

e data collection and storage (data analysis working group) 


Data will be collected internally by the FIM software, by the engineering work 
stations on the FIM-equipped aircraft, and on the Boeing 737’s Digital Flight 
Data Recorder. No data will be gathered in the target aircraft. Target aircraft 
state data delivered via ADS-B will be recorded in the first FIM aircraft in the 
stream. Analysis consistent with the Statement of Work will be accomplished 
post-flight by the contracting team. 


Wind Tunnel — None 


Simulation and Training 


Previous research to characterize the ASTAR spacing algorithm and ensure 
acceptability of the FIM procedures included the following ATD-1 human-in-the- 
loop experiments conducted at NASA Ames and NASA Langley Research 
Centers: FIAT-4, CA5.3, RAPTOR, I-SIM, and IMAC. 


Another precursor to this flight test activity was the ATD-1 Avionics Phase 1 
demonstration of EAGAR in December 2014. This flight test used Boeing’s 
ecoDemonstrator Boeing 787 test aircraft under a Space Act Agreement. This 
was preceded by a simulation experiment using two of Boeing’s engineering 
simulators (Boeing 737 and 777) and an ASTAR implementation developed by 
ACSS. 


In direct support of this flight test, the contractor will provide rudimentary initial 
training of the FIM hardware and software for the flight crews. Honeywell and 
UAL will also provide aircraft familiarization and egress training for all 
participants (researchers, engineers, observers, etc.). 
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NASA Langley will provide computer-based training (available upon request) and 
simulator training on representative aircraft platforms with representative FIM 
pilot interfaces (planned for the DTS or IFD) to enable training of the flight 
routes, instrument procedures and flight test procedures. The Langley simulation 
will also provide training for the Flight Test Director (scenario progression, 
contingency operations, etc.) and the research observers (data recording, 
communication with the Flight Test Director, etc.). This training will be based on 
the following two contract deliverables, which are available upon request: 

e FIM Avionics Technical Manual (deliverable 4.16) 

e FIM Avionics Operations Manual (deliverable 4.17) 


1.8.4 Ground Operations Systems Checkout 


Once the FIM equipment is installed in each aircraft, it will be subjected to 
ground testing as documented in the Ground Test Plan (deliverable 4.21). The 
main purpose of ground testing a system is to ensure that the system is properly 
installed in the aircraft and that other systems such as TCAS are not adversely 
affected. As such, all equipment associated with the FIM avionics system that is 
newly installed or modified will be verified on the aircraft for functionality in 
accordance with the Ground Test Plan. Other ground tests will be developed 
during the program to verify proper installation and some basic functionality of 
the FIM system. 


The FIM system will be installed in the 757 at Honeywell’s FAA-approved repair 
facility in Phoenix. Ground tests have been initiated, and the final ground and 
EMI checks will be performed on the 757 by the Honeywell flight test 
organization in January 2017 before the aircraft is ready for flight. This will be 
accomplished in accordance with the Ground Test Plan (contract deliverable 
4.21). 


UAL engineers and mechanics will carry out installation and ground testing of the 
FIM system and revised avionics boxes in the 737 at a UAL FAA-approved repair 
facility in Denver prior to any shake-down flight or prior to the first contract test 
flight if no shakedown flight is performed. The same ground checks will be 
performed prior to flight in accordance with the Ground Test Plan (contract 
deliverable 4.21). 


Tests will be performed after the initial installation of the equipment and after any 
significant modifications to the system or the aircraft. 
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1.9 Proposed Schedule Milestones 


The ATD-1 Work Plan lists all key milestones for this program and is the source 
document. Below is a subset of the dates: 


Y Preliminary Design Review (PDR) 24 Sept 2015 LaRC 

v Briefing to RSD 13 Jan 2016 LaRC 

Y Introductory briefing to ASRB 14 Apr 2016 Boeing 

Y Critical Design Review (CDR) 5 May 2016 Honeywell 

v Flight test plan delivered 29 June 2016 Boeing 

v Langley Research Center IRB approval 22 Aug 2016 NASA 

¥ Johnson Space Center IRB approval 22 Sep 2016 NASA 

¥ Computer based training 18 Nov 2016 LaRC 

Vv Flight training sim 29 Nov—8 Dec 2016 LaRC 

e Operational Safety Review (OSR) 8 Dec 2016 Boeing (D Boyle) 
o LaRC ASRB: Limited Flight Safety Release for calibration and deployment flights 

e System Acceptance Review (SAR) 15 Dec 2016 Honeywell 

e Possible RSD on-site inspections TBD at install site 

e Ground test plan complete 12 Jan 2017 Boeing 

e Company Flight Readiness Review (FRR) 17 Jan 2017 (est) Honeywell, UAL 
o Mechanism for Flight Safety Release of individual aircraft 
o NASA ASRB issues Flight Safety Release for flight test campaign 

e Project Readiness Review for Flight 17 Jan 2017 all participants 


o Contract deliverable 4.14 
o All participants demonstrate their readiness for flight test campaign 


e Flight test window per Honeywell & UAL letters of commitment 1/12-3/3 2017 
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2. Flight Test Operations 


The flight test series is to be conducted using arrivals and Required Navigation 
Performance (RNP) approaches. These arrival/approach combinations will mirror those 
used in high-density airport operations, but will be flown into Grant County (KMWH) 
(i.e., Moses Lake, Washington) airfield for the majority of the test points, to economize 
on test flight costs. 


The target aircraft (not FIM equipped but ADS-B Out equipped), which will always lead 
a string of three test aircraft, will be a Honeywell Dassault Falcon 900 or a business jet 
with equivalent performance and capability. The trailing (FIM equipped) aircraft in a 
three-aircraft string will be a Honeywell 757 test aircraft and a UAL 737-900. In Final 
Approach Spacing test conditions, only two aircraft are required, and the intent is to use 
the 757 and 737 to maximize flexibility. All aircraft will be flown by qualified company 
pilots, with research engineers and observers on all three aircraft. 


The Flight Test Director (FTD) will be in the Boeing 757 while a back-up FTD will be in 
the Boeing 737 to allow for continuation of testing should the 757 become unserviceable 
after launch. Both aircraft will have sufficient onboard FIM and test equipment, as well 
as ATC and inter-aircraft communications, to enable effective monitoring and 
management of the test processes by either FTD or backup. 


Based on a day’s plan, three aircraft will depart individually from their deployed location 
in the Seattle area, and climb eastbound along a defined route towards KMWH. Normal 
ATC departures, procedures, and frequencies will be used. Once established at cruise 
altitude, the first (en route) flight test condition will be executed. Once this test condition 
has been completed, the aircraft will reposition as needed to accommodate initiation of 
the second (arrival/approach) test condition. That test will continue throughout the 
arrival and approach, and will terminate when the second FIM aircraft crosses the final 
approach fix. The aircraft will continue of the approach and then execute a go-around at 
decision altitude to commence a repositioning climb-out for the next test condition. Once 
reestablished at cruise altitude, the next condition will commence and continue until the 
aircraft again crosses the final approach fix. It is estimated, based on fuel burn, that 
between four and five test conditions will be accomplished in a flight test day. 


If only two aircraft are available, a decision will be made, depending on the 
circumstances of the lack of availability, to launch the remaining pair or continue the test 
day with the remaining pair. Test conditions already included in the flight test plan (for 
pre-launch decisions) or already briefed prior to flight (for post-launch decisions) will 
always be executed. 


Because test aircraft will be based in Seattle, some “target of opportunity” FIM 
operations may be conducted during the return to the Seattle area (Seattle-Tacoma 
International Airport (KSEA) for the 737 and Boeing Field (KBFI) for the other aircraft). 
These FIM operations conducted during the return to the Seattle area are not considered 
part of the test matrix itself, but rather they represent opportunities to provide data points 
using participating or non-participating traffic in an unplanned (but pre-coordinated) 
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ARTCC environment. During “target of opportunity” operations during the return flight 
to the Seattle area, the rules of engagement are flight crew will not query ATC or other 
aircraft as to that aircraft’s route of flight, nor state that they intend to conduct a spacing 
operation behind other aircraft. 


All flight test aircraft will comply with all ATC procedures, for example: 

e Coordinated operations by single aircraft (i.e. no formation flight, no chase flight), 

e Normal aircraft separation criteria (IFR standard in IMC and VMC), 

e Utilize ATC surveillance-based services for separation both participating and non- 
participating traffic, and for traffic awareness, 

e Departure and arrival procedures into Seattle and Moses Lake TRACONS, 

o FAA standard departures, arrivals, and approaches from/into Seattle 

o Customized, FAA-approved arrivals (STAR Specials) into Moses Lake (Jeppesen 
navigation database in all FMSs) 

o FAA standard instrument approaches into Moses Lake 

Avoid Spokane TRACON airspace and two MOAs to the north, 

Minimize exposure to crossing Victor routes (achieved by arrival route design), 

Standard rate turns and airspeeds within 15% of published/custom procedures, 

Regulatory requirements (eg <250 knots <10k), 

Compliance with maximum speed restrictions for RF legs in the published public 

instrument approach procedures, 

e ATC instructions (eg vectors, step-down, speed, procedure abort). 


All aircraft limitations and company standard operating procedures will be adhered to: 

e That contractor’s FAA approved Part 91 approval with Experimental Category 
certificates, 

e Weight and balance, maximum takeoff/landing weights, 

e Wind, temperature, icing, turbulence criteria. 


Locations 


The Honeywell and UAL aircraft will deploy from their home bases to the Seattle, 
Washington area, and will operate from KBFI and KSEA respectively (see Figure 1). On 
flight test days, aircraft will depart individually, but with coordination between ATC 
Towers, en route to KMWH, where they will fly multiple approaches to missed 
approaches. The aircraft may or may not refuel at KMWH, and will return every day to 
the deployed operating airfield in the Seattle area. 
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2.2 


2.3 


2.4 


Figure 2: Seattle area and Grant County operating locations 


Planned Start of Flight Tests 


The flight tests are planned to begin in mid-January 2017, and will be complete by March 
2017. 


Honeywell will support their Dassault Falcon 900/business jet and Boeing 757 
deployments to KBFI for 18 flight days (ferry time and downtime due to equipment 
delays and ATC coordination not included). 


UAL will support their Boeing 737 deployment to KSEA for up to 82 hours of test time 
(ferry time not included). Utilization of the 737 must be terminated in time for de- 
modification and return-to-service procedures to be completed to allow revenue service 
on 7 March. 


Planned Number of Flights 


The ATD-1 Avionics Phase 2 flight test will be a maximum of 18 flight days, or 15 to 20 
flights for all aircraft. The nominal expectation is one flight per day, resulting in 
approximately 80 to 85 flight hours. This estimate will be updated based on how 
efficiently multiple test conditions can be conducted per flight. 


Frequency of Flights 


One (expected norm) or two flights per day per aircraft will be conducted with the 
intention of conducting 4 to 5 test conditions per day. If only one flight is scheduled, it is 
anticipated to be a longer flight (~5 to 6 hours), and would depart and return to the 
appropriate airfield in the Seattle area. If two flights are scheduled, it is anticipated each 
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will be a shorter flight (~3 to 4 hours) departing and returning to the Seattle area, but with 
a refueling stop at KMWH between the two flights. 


All regulatory and company crew duty day and crew rest restrictions will be adhered to. 


Test Procedures 


The goal of the procedures being flight tested is to achieve and/or maintain a precise 
spacing interval behind a specified target aircraft by a specific waypoint or at a specific 
rate or better. For the flight test, this spacing interval will always be set to a value that is 
larger than the IFR minimum separation for the aircraft pairing by a margin that has been 
agreed with ATC. 


The flight test procedures are: 
e The flight crew enters the following information into the FIM avionics: 
o Ownship route information 
o Forecast en route or descent wind 
o FlM clearance information from ATC (ATC simulated by the test card) 
e The FIM avionics calculate the airspeed for the aircraft to fly based on: 
o Ownship info (from aircraft data bus), target state (from ADS-B in), route info 
(manual entry by pilot), and forecast wind (manual entry by pilot) 
e The flight crew sets the FIM speed manually into the MCP speed window 
e All other aircraft and IFR procedures are standard, current-day operations 


The flight test will include either two or three aircraft, based on the availability of the 
UAL aircraft, or whether or not an aircraft had maintenance issues and had to abort. 
Operations en route to KMWH and all the arrival operations into that airport will only 
involve the two or three aircraft participating in the ATD-1 Flight Test. 


Operations when departing KMWH and returning to the Seattle area include not only the 
participating aircraft, but may include non-participating aircraft as long as the aircraft 
geometry is conducive to a FIM operation, and it does not impact Seattle Center’s 
operations. 


The Flight Test Director is responsible for developing a minimum research equipment list 
to be used as a Go / No-Go decision matrix. This minimum research equipment list will 
be delivered to the FTD prior to the Flight Readiness Review in Jan 2017. The Flight 
Test Director will also develop backup plans to modify (pre-flight) or make alternate use 
(after launch) of the daily test plan in order to accommodate aircraft unavailability. 


Planned Flight Test Envelope 


All aircraft will operate within the normal operating envelope of the specific aircraft 
model, and not exceeding that typical of commercial passenger aircraft conducting a 
revenue flight. There are no research requirements that are more restrictive than the 
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aircraft’s Pilot’s Operating Handbook (POH) or the company’s Standard Operating 
Procedures (SOP), nor any research requirements that require the POH or company’s 
SOP to be exceeded. 


Flights will occur day or night, in IMC or VMC. All aircraft and operator procedures will 
be adhered to, as will all ATC procedures and separation criteria. All operations will be 
conducted under IFR regardless of meteorological conditions. 
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3. Support Requirements 
3.1 Support Organizations and Their Responsibilities 


3.1.1 NASA 
e CSAOB 
o Create CBT and create simulation training for flight test. 
o Assist in developing and executing the flight test. 
© Participate as researcher observers on any of the three aircraft. 
o Participate as researcher observers in Seattle ARTCC (ZSE) or Moses 
Lake TRACON (MW4H) air traffic control facilities. 
o Provide daily summary/update during flight test (via e-mail). 
e ATD-1 Project 
o Resolve resource issues or conflicts. 
e HQ Public Affairs 
o Coordinate with contractors and airports for photo opportunities. 
e LaRC RSD Flight Ops 
o Coordinate with HQ to determine if flight operations review needed. 
o Provide consultation to CSAOB in developing flight test plan and FTOSR. 
e LaRC IRB and JSC IRB 
o Review and approve data surveys and procedures to collect data. 


3.1.2 Boeing 
e BR&T 
o Lead development of Flight Test Plan. 
o Flight Test Director; provide overall direction and execution of flight test. 


o Provide support developing algorithm, FIM cockpit displays, and 
hardware installation. 

o Develop Data Gathering and Analysis Plan. 

o Analyze flight test data. 


3.1.3 Honeywell 

e Avionics 

o Integration of certified and research hardware and software to meet FIM 
requirements as specified in the NASA SRD. 

e Algorithm 
o Develop algorithm and interface to enable FIM operation 

e Aircraft 
o Provide target aircraft (Falcon 900, non-FIM equipped) for the flight test. 
o Provide FIM equipped research aircraft (Boeing 757) for the flight test. 
o Aircraft to be maintained and modified by FAA approved repair facility. 

e Flight Ops 
o Provide trained crews to participate in flight test. 
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= Pilots trained by the airframe manufacturer, and 14CFR standards 
are followed for currency, qualification, and medical (all pilots 
meet PIC qualification standards). 

o Provide training for any onboard participants (researchers, observers, 
visitors). This training occurs the day of the flight and is conducted by one 
of the crew members. Participants are not required to have a medical 
screening prior to boarding. 


3.1.4 United Airlines 
e Aircraft 
o Provide FIM equipped aircraft (Boeing 737) to participate in flight test. 
o Aircraft to be maintained and modified by FAA approved repair facility. 
e Flight Ops 

o Provide trained crews to participate in flight test. 

o Provide training for any onboard participants (researchers, observers, 
visitors). This training occurs the day of the flight and is conducted by one 
of the crew members. Participants are not required to have a medical 
screening prior to boarding. 


3.1.5 Jeppesen 
e Avionics 

o Provide FMS navigation database (NDB) data to Honeywell for packing 
and eventual use by Honeywell and NASA. The data have also been 
provided to General Electric for packing and use by UAL and NASA. The 
NDBs contain customized arrival procedures into KMWH and published 
approach procedures into KMWH. 

o NDBs have been provided for integration into the FIM systems, and for 
loading in the Honeywell FMSs in the Boeing 757, the Falcon 900, and 
the Embraer 170 (as required). NDBs suitable for loading into General 
Electric FMCs in the Boeing 737 have also been provided. NDBs for 
NASA’s 757 and 737 simulators have also been provided. 


3.1.6 ATC 
The following ATC facilities will interact with the ATD-1 Flight Test campaign: 
e Seattle TRACON 
o Coordinated departures to set-up the en route FIM operation 
o Coordinate return times, especially when slot times are required 
e Seattle ARTCC 
o All of the en route FIM operation occurs in Seattle ARTCC airspace 
o Arrival FIM operations on the special STAR procedures 
e Moses Lake TRACON 
o Arrival FIM operations when aircraft are below 10,000 ft msl on special 
STAR procedures, and on published IAP 
o All of the FINAL FIM operation 
e Moses Lake Tower 
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o When directed by the TRACON, visual approaches, and if landing 


3.1.7 Airfields 
The following airfields will be used in the ATD-1 Flight Test: 
e Moses Lake (KMWH) 
o FIM operations 
o Divert airfield if needed for weather or slot time in Seattle area 
e Boeing Field (KBFI) 
o Deployment location for Honeywell F900 and B-757 
e Seattle Intl (KSEA) 
o Deployment location for UAL B-737-900 


3.2 Transportation to Test Location 


Transportation to the test locations (KMWH [observer], KSEA and KBFI) will be 
provided by that person’s respective employer (NASA, Boeing, Honeywell, and UAL). 
Once at the test location, it is expected that transportation will be provided or coordinated 
by the aircraft operator (Honeywell or UAL) or the airfield operations department. 


3.3 Chase — Not Applicable 


3.4 Photo and/or TV Coverage 


An airborne photo session (i.e., formation flying where one aircraft films the other 
aircraft) is not planned and will not be conducted. 


NASA Public Affairs is working with their counterparts in each of the companies to 
arrange a pictures, videos, and interviews with all the participants and the aircraft. These 
events will occur on the ground and while airborne. The following will be adhered to: 
e Ground sessions 
o One or two events, coordinated a week in advance with all the flight 
operation departments and the airfield (badging requirement) 
o Comply with all company and airfield photo restrictions 
o Only time interviews occur 
e Flights 
o One or two sorties, coordinated a week in advance with all the flight 
operation departments and airfield operations (badging requirement) 
o Aircraft safety briefing by the flight crew or flight engineer 
o Movement about the cabin and taking pictures and video only when 
authorized by the flight crew or flight engineer 
o No interviewing of the flight crew while airborne 


Regardless if a media event or not, at the discretion of the aircraft Captain and if in 
accordance with that particular airfield rules, personal photos by participants may be 
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taken while airborne or on the ground. The company rules and airport rules will be 
documented and provided to all participants. 


Tracking — Not Applicable 
Telemetry — Not Applicable 
Communications 


A dedicated VHF flight test frequency has been obtained from Boeing Flight Test for 
aircraft-to-aircraft and Flight Test Director to pilot communication. However, neither 
Seattle ARTCC nor Moses Lake TRACON has the capability to tune to and transmit on a 
VHF frequency not permanently assigned to them. Therefore, the primary method of 
communication between the controllers and pilots will be conducted on the normal and 
appropriate ATC frequencies. 


Each ATC facility has received several coordination briefings leading up to the beginning 
of the flight test campaign, and contributed substantially to the design of the custom 
arrival procedures and missed approach procedures. Each facility will dial into the 
morning brief and afternoon debrief, and they will discuss their issues for the day (eg 
predicted heavy arrival times requiring slot control, unexpected events during the flight 
test, etc.). Furthermore, each control facility will also have their own set of test cards that 
will be flown for that day. 


The tertiary method of communication is via the internet using an aviation software 
application called “Planet”. The software can: 
e provide situational awareness of selected aircraft relative to other aircraft, 
airways, or airspace; 
e provide overlays of forecast wind and current convective weather; and 
e allow users to communicate with each other via chat messaging. 


While the ATC facilities will not have this software in the vicinity of controllers, there is 
a possibility the ATC facility managers will be able to have internet access available at 
the Supervisor or Traffic Flow Management stations to allow direct chat communication 
between the Flight Test Director and the air traffic control supervisor. 


An illustration of the communication options is shown in the figure below. 
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Figure 3: ATD-1 Communication 


3.8 Meteorological 


Flight crews will obtain their own flight weather support during deployed operations 


using their normal sources. 


A single source of forecast wind data for en route test conditions and for descents into 
KMWH and the Seattle area will be established and used by all aircraft conducting FIM 


operations. 


3.9 Data 


All data will be recorded on board each aircraft by either ship systems or the FIM 
avionics. Honeywell will provide an engineering workstation in the form of a laptop as 


part of this capability. 


3.10 Other Special Support Requirements 


All three aircraft will operate under FAR Part 91, Experimental Category. Initially the 
experimental sub-category will be “research and development”, which means only 
required crew-members will be permitted on board. Once experience has been gained, 
log-book entries will be made to change the experimental sub-category to “market 


survey’, which allows visitors and non-crew members on board. 


NASA Langley will provide researchers that will fly aboard the three aircraft to act as 
observers, data collection, and conduct pilot surveys. The NASA researchers are 


considered required crew members. 
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In addition to members of the ATD-1 Avionics Phase 2 research team (comprised of 
individuals from NASA and all the contractors), there will also be observers on board all 
three aircraft. These observers will be from NASA and all the contractors, as well as the 
FAA and other industry stakeholders. The goal of providing access to observers from 
outside the flight test team is to allow key decision makers and public outreach 
individuals to observe first-hand the FIM equipment and procedures. The operators of the 
aircraft (Honeywell and UAL), will 

e Ensure that each person meets all the requirements, 

e Provide all required egress and personal training, 

e Establish a boarding approval and personnel tracking process 

e Have final approval/disapproval authority to board the aircraft. 


In addition to the items described above, any NASA employee or visitor invited by 


NASA will also require boarding authorization from NASA. The NASA Langley 
Research Center process will be used for this. 
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Safety 
System Safety Program 
4.1.1 Hazards Analysis 


The flight test conditions incorporate a combination of normal en route, arrival and 
instrument approach procedures, and crew reaction to speed guidance from a prototype 
FIM system. This guidance is intended to result in the achievement and/or maintenance 
of a spacing value from a preceding or merging aircraft. Thus, the only real difference 
between everyday operations for air transport aircraft and the flight test operations will be 
the source of speed guidance. In normal operations, speed-to-fly is provided by the 
FMS’s performance model, or from arrival and approach procedure restrictions and 
constraints, or by air traffic controller. Since the source of speed guidance in the flight 
test is prototype hardware and software, this analysis concentrates on hazards associated 
with this speed guidance and their outcomes. 


During the project’s introductory briefing to the ASRB (14 April 2016), it was agreed 
that the contractor team need not analyze the hazards and risks of normal operations since 
they are adequately mitigated through FAA approved operating certificate, FAA 
approved mechanics and maintenance procedures, FAA certified commercial pilot 
certification, type rating on test aircraft, and initial and recurrent training. No hazards that 
might have an effect only on flight test operational efficiency or ability to complete the 
flight test series have been considered. 


The ASRB further concluded that the Operational Safety Assessment included in the 
Safety, Performance and Interoperability Requirements Document for Airborne Spacing 
— Flight Deck Interval Management, RTCA DO-328A, was a suitable source of hazards, 
risks and mitigations for a certified system. In addition, DO-328A and the supporting 
system’s Minimum Operational Performance Standards (DO-361) were used as the 
sources of the majority of the requirements that the prototype system was designed to 
meet or exceed. Although the prototype system will not be certified for operational use, 
most hardware has been certified for other uses, and commercial best design practices 
have been followed in development of the prototype software. 


Annex A summarizes these hazards, and then analyzes the same hazards and mitigations 
associated with the provision of speed guidance by a prototype avionics system. Added 
mitigations for the risks associated with the latter are also offered. The five FIM-specific 
hazards identified were: 

1) Incorrect initiation of the FIM procedure 

2) Incorrect or inappropriate execution of FIM procedure 

3) Incorrect or abnormal termination of FIM procedure 

4) Electro-magnetic interference (EMI) of certified aircraft systems 

5) Insufficient cockpit task management 


Flight test day one will be dedicated to data collection. The following day will be 
dedicated to the analysis of the data recorded on the first day. The second day will also be 
used by the Flight Test Director and all participants to validate that all hazards have been 
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identified and mitigated. Any proposed modifications or changes will be communicated 
and agreed to by the Honeywell flight operations, United Airlines flight operations, and 
the NASA LaRC ASRB prior to implementation. 


4.1.2 Risk Assessments 


The five FIM-specific hazards identified were all assessed as Low risk (flight operation 
permissible following review and approval) after the mitigations are applied. 


The undesirable operational effects that may result from the hazards analyzed are as 
follows: 


Various levels of increase in flight crew workload 

Various levels of increase in air traffic controller workload 
Reductions in spacing not impinging on separation 

Loss of separation 

Near mid-air collision 

Collision 


4.2 General Operational Restrictions and Conditions 


4.2.1 Weather 


The research conducted during these flights does not require weather restrictions or 
conditions more stringent than those required by that aircraft type, and that aircraft 
operator. Specifically, the ATD-1 flight test can occur day or night, in VMC or IMC, 
with no additional restrictions to the POH limits to wind, temperature, icing, or 
turbulence. All ATD-1 scenarios will be flown to the published Decision Altitude (DA). 


4.2.2 Personal Equipment 


Personal flotation devices and other appropriate survival and personal protective gear will 
be provided on-board for all personnel as required by the flight profile. 


4.2.3. Minimum On-board Equipment 


For research purposes, the FIM equipment, the experiment’s data recording devices, and 
the method to receive updated wind forecasts must be operational. In addition, existing 
aircraft avionics sub-systems providing data to the FIM System must be operational. The 
required number of radios to communicate with ATC and coordinate between aircraft 
must also be operational. 


The go/no-go decision regarding the research equipment and conditions will be the 
responsibility of Boeing’s designated Flight Test Director in coordination with the NASA 
Flight Test Technical Lead. The final go/no-go decision responsibility will reside with 
the pilot of each aircraft. Aircraft minimum equipment will be dictated by the 
appropriate published Minimum Equipment List (MEL) and standard operational 
practices. System architecture that includes single data sources for the prototype FIM 
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avionics dictates that the MEL for the flight tests be more restrictive than that utilized in 
revenue service for the aircraft models. 


4.2.4 Weight and Balance 


The aircraft will be flown within the approved weight and balance limits in the Pilot 
Operations Handbook (POH) and the Aircraft Flight Manual (AFM). 


4.2.5 Flight Test Envelope (V-n) 
The aircraft will be flown within the approved envelope in the POH. 
Abort Procedures 


There are two general categories that may require the flight test to abort: 
1) functionality of the FIM equipment, its data sources, and data collection 
equipment (defined in minimum research equipment list), and 
2) encroaching on the minimum aircraft spacing value (initially negotiated with ATC 
as 7 nmi in the ARTCC and 5 nmi, with those values to be reevaluated after 
experience has been gained conducting the flight test). 
a. There are no research test conditions with less than 5 nmi separation. 
b. The flight crews will use spacing values of 150-210 seconds (time-based 
operations) or 5.5-7 nmi (distance-based operations) when on final. 
c. Controllers retain their current-day primary responsibility for aircraft 
separation, and flight crew shall maintain awareness using certified 
equipment and their company operating procedures. 


The pilots, ATC, or researchers have the authority to call for an abort. The flight test 
abort procedure is to revert to normal operating procedures, requiring either that the 
airspeed constraint shown for the published procedure be respected, the speed issued by 
air traffic control be flown, or the speed from that company’s standard operating 
procedure for that phase of flight be flown. ATC shall be informed of abandonment of 
the FIM procedure and reversion to the standard speed profile. 


The Flight Test Director has overall responsibility to determine if all flight research for 
the day has been met, and is the final decision-maker to launch, delay, suspend, resume, 
or cancel the flight test. 


Emergency Plans and Procedures 


The Flight Test Director, has overall responsibility for on-scene decision making, and 
communication with all Flight Test partners, air traffic control, flight crew, and airfield 
managers for issue pertaining to the flight test campaign. Each flight crew remains 
responsible for their aircraft and their crew, and is responsible for responding to 
emergencies specific to their aircraft, coordinating with air traffic control for priority 
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handling (if required), and notifying their company in accordance with their safety 
processes. 


All events or circumstances that flight crews, flight test directors and observers see as 
problems in the course of flight testing must be recorded and reported. The objectives are 
1) to facilitate safety incident reporting and 2) to register occurrences that affect the 
performance of the FIM function. Annex B is Honeywell’s Hazard Identification and 
Hazard/Risk Management Tracking Forms, and these should be used for this process. 

The Flight Test Director will have these forms available during flight test debriefs. 


If any problems that threaten aircraft or operation safety are encountered, flight crews 
should follow their own operators’ associated processes and procedures while 
abandoning the FIM procedure and informing ATC. These processes are summarized as 
follows (see Annex C, Contingency Response Checklist): 


UAL: In the event of an airplane malfunction or other emergency unrelated to the 
flight test, the UAL crew will follow established procedures in the UAL Flight 
Operations Manual. In brief, these include notifying and coordinating with UAL 
Dispatch via ACARS or radio for any required technical assistance or diversion plans. 
In the event that the crew is unable to initiate the process, any member of the flight 
test team with knowledge of the issue should contact Craig Stankiewicz at (872) 825- 
9110 (desk) or (847) 567-3864 (cell). 


Honeywell: HONEYWELL FLIGHT TEST OPERATIONS: Any member of the 
Honeywell Flight Test Crew becoming aware of an incident or accident involving a 
Honeywell Flight Test Aircraft or Personnel on the ground or airborne, will follow 
the Emergency Response Plan (ERP) process as outlined in Chapter 17 of the 
Honeywell Aerospace Flight Test Operations Manual. 


The NASA ATD-1 Flight Test Technical Lead (Brian Baxley) will notify the NASA 
LaRC Aviation Manager (757-864-7700) of any incidents or accidents as soon as 
possible as specified in LMS-OP-0939. The backup for notification is the LaRC 
emergency dispatcher (757-864-2222). 


Configuration Control Responsibilities 


Boeing R&T is the prime contractor and therefore has overall responsibility, and 
Honeywell and UAL report to Boeing. There are six Boeing deliverables for this contract 
that pertain to software and configuration management, and are available upon request: 
e Software Development Plan (deliverable 4.4a) 
e Software Configuration Management Plan (deliverable 4.4b) 
Software Requirement Specification (deliverable 4.4c) 
Software Design Description (deliverable 4.4d) 
Software Test Plan (deliverable 4.4e) 
Software Version Description (deliverable 4.4f) 
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Configuration Control will be accomplished using the configuration management 
processes of the aircraft operators (Honeywell and UAL), which are in accordance with 
FAA guidelines. 
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Abbreviations & Acronyms 


ADS-B Automatic Dependent Surveillance — Broadcast 
AFM Aircraft Flight Manual (pseudonym for POH?) 
ARTCC Air Route Traffic Control Center 

ASP Airspace Systems Program 

ASRB Airworthiness and Safety Review Board 
ASTAR Airborne Spacing for Terminal Arrival Routes 
ATC Air Traffic Control 

ATD-1 Air Traffic Management Technology Demonstration- | 
ATM Air Traffic Management 

CDR Critical Design Review 

CDTI Cockpit Display of Traffic Information 

CGD Configurable Graphics Display 

EFB Electronic Flight Bag 

ETA Estimated Time of Arrival 

FAA Federal Aviation Administration 

FAR Federal Aviation Regulations 

FFOV Forward Field of View 

FMS Flight Management System 

FSR Flight Safety Release 

FSR Flight Safety Review 

FTOSR Flight Test Operations and Safety Report 

IFR Instrument Flight Rules 

IMC Instrument Meteorological Condition 

KBFI Boeing Field / King County International Airport 
KMWH Grant County International Airport 

KSEA Seattle-Tacoma International Airport 
LNAV/VNAV _ Lateral Navigation/Vertical Navigation 

MCP Mode Control Panel 

MOPS Minimum Operational Performance Standards 
MWH Moses Lake TRACON 

NAS National Airspace System 

NASA National Aeronautics and Space Administration 
ND Navigation Display 

NDB Navigation System Database 

OSR Operational Safety Review 

PDR Preliminary Design Review 

PER Preliminary Engineering Review 

PFD Primary Flight Display 

PFOV Primary Field of View 

POH Pilot Operating Handbook (pseudonym for AFM?) 
RAC Risk Assessment Code 

RNAV Area Navigation 

RSD Research Services Directorate 

SOW Statement of Work 
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System Requirements Document 

Standard Terminal Arrival Route 

Traffic Collision Avoidance System 
Traffic Processor Unit 

Terminal Radar Approach Control Facility 
United Airlines 

Visual Flight Rules 

Visual Meteorological Conditions 

Seattle ARTCC 
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Annex A. Hazard Assessment and Operational Effect Mitigation 


A.1 INTRODUCTION 


Only flight-safety-related hazards have been considered in this hazard assessment; programmatic 
effects, like failure to complete a test condition are not discussed. The methodology and process 
used for hazard assessment and their mitigations is based on the following: 


e The Operational Safety Assessment (OSA) for FIM by RTCA SC-186 Working Group 4 

e Honeywell Aerospace Flight Test Operations Manual, Chapter 2 Safety Management 
System, Section 2.5 Safety Assurance and SMS Evaluation 

e UAL risk assessment procedures 

e FAA Order 4040.26B (Aircraft Certification Service Flight Test Risk Management Program) 
used by UAL for their experimental STC operations 

e NASA Langley’s hazard analysis outlined in LF273F 


All FIM (section A.2) and non-FIM (section A.3) hazards have been assessed as low risk, or the 
equivalent to NASA Langley’s Risk Assessment code (RAC) of 3. 


A.2. FIM-SPECIFIC HAZARDS AND MITIGATIONS 


A rigorous Operational Safety Assessment (OSA) for FIM-S was carried out in the industry 
standards development committee (RTCA SC-186 Working Group 4) during the development of 
the requirements for the operational application and its supporting system. The results are 
published in RTCA DO-328A, Safety, Performance and Interoperability Requirements 
Document for Airborne Spacing — Flight Deck Interval Management, Appendix C. The hazards 
identified in this assessment along with the mitigations used provide a basis for the Hazard 
Analysis and the Risk Assessment for the ATD-1 Avionics Phase 2 flight test. All hazards 
unique to the FIM equipment and procedures were assessed as having low risk (section A.5). 


For all of the identified hazards that can result from software errors, one mitigation is the process 
adopted during software development, which reduces the probability of occurrence of such 
errors. Although the FIM system, TPU and transponder are not certified systems, they have been 
subjected to an appropriate level of development rigor, understanding that the resulting system is 
a prototype and will not be certified for operational use. Both the TPU and the EFB include 
legacy Honeywell software items. 


The risk assessment defines the mitigations that will be employed during the flight test to 
overcome increased exposure to hazards associated with the use of a prototype system and assure 
safety in flight testing in the environment that will accommodate the test. The range of 
undesirable operational outcomes considered in the OSA is wide, but the mitigations adopted for 
the flight test will reduce associated risks to eminently acceptable levels. 

While the arrival, departure and en route procedures will be normal operations with the 
exception of the source of speeds to fly, any adverse effects of repeated climb-outs and 
arrivals/approaches in winter conditions will also be considered. 
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A.2.1 Software Development Methodology 
The Software Development Plan explains the approach taken to software development. While 
Boeing and Honeywell would ordinarily develop avionics software per RTCA DO-178B/C 
(Software Considerations in Airborne Systems and Equipment Certification), following those 
processes for this project would have added significant cost without a clear benefit given that the 
operations supported are not safety-critical. The development proceeded in accordance with 
commercial best practices and prototype development standards applicable to each development 
location and as pertains to Class D, non-safety-critical software. 


Software requirements were first analyzed at a high level for feasibility of implementation within 
program constraints and its ability to be verified. Functional architecture was then defined to 
provide a basis for allocating requirements. System, subsystem and interface requirements were 
then allocated to the appropriate hardware and software components. Each performance or 
interface requirement was assigned one or more corresponding verification requirement. 


Traceability to requirements was established by performing automated and/or operational system 
tests in an effort to verify that each requirement was met. The success or failure of the test was 
documented, capturing the then-current state of the system as far as its ability to meet expected 
requirements. 


A.2.2 DO-328A Operational Safety Assessment (OSA) of FIM-Specific Hazards 


A.2.2.1 Overview 
The OSA addresses the Operational Hazards and internal failure modes of a system that enables 
FIM. Operational Hazards are the result of use of the application in the operating environments 
defined in the same document or of internal failures of the system enabling the application. An 
Operational Hazard is any condition, event or circumstance that could lead to an Operational 
Effect (e.g., accident or incident, workload increase). Mitigations are employed to reduce the 
probability of the hazard’s occurring, and to reduce the probability of the effect’s occurring or to 
reduce the severity of the effect. The overall objective is that safety targets (in terms of 
probabilities for each level of severity) set by the FAA and EASA be met. 


A.2.2.2 Operating Environment 
References in the following are to RTCA DO-238A. Table C.8 of the OSA defines conditions 
for the operating environment in which FIM procedures will be executed: 
e Airspace in which direct air/ground voice communications services are available. 
e Surveillance airspace under positive control 
e Incruise, arrival and approach phases of flight 
e Airspace operating under IFR 
e In VMC or IMC 
The airspace and operating plan for the ATD-1 flight test satisfy all these conditions. 


A223 FIM-specific hazards 
Table A.1 lists a summary of hazards identified in the OSA; these include the possible effects of 
use of uncertified equipment. Each description below includes the hazard, the form of the 
hazard, the most likely causes, and a reference to the mitigations used. Significantly more detail 


REV NEW D780-10413-1 Page 37 of 52 


RS 
Q SOEING Honeywell baad 


can be found in the published DO-328A document. One additional FIM-specific hazard not 
listed in DO-328A is also included as risk #5, and it is associated with both pilots being head- 
down focusing on the FIM equipment and not maintaining control of the aircraft (aircraft state 
awareness, positional awareness, traffic awareness, etc.). 
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Hazard sees Form of Hazard Cause GEA MONS 
Level (see below) 
Selection, in the FIM avionics, of the ones cect a ; bead 
: Voice message corruption in clearance 5 
wrong target aircraft ; 
Corruption by FIM system 1,2,4 
Incorrect : 
meaner s docs i ics Controller or pilot error 12.5, 6, 7 
initiation of Selection, in the FIM avionics, of the : Er 
L : : Voice message corruption in clearance 5, 6 
the FIM wrong Assigned Spacing Goal : 
poncauce Corruption by FIM system 1,2 
P Selection, in the FIM avionics, of the Controller or pilot error 1,2,7,8 
wrong Achieve-by Point or Planned Voice message corruption in clearance 3 
Termination Point Corruption by FIM system 1,2,8 
FIM System corrupts speed guidance Li 
calculation 
Undetected horizontal position corruption LZ 
or error, target or FIM aircraft 
: Incorrect pilot selection (in Mode Control 1,2,7,9 
Incorrect speed is flown Panel) 
nahi - EFB or CGD screen failure, or other 1,7, 14 
ae ae oa component of FIM equipment freezes speed 
Execution of L ; : : 
FIM guidance value creating failure not 
immediately recognizable by flight crew 
Speed flown is outside the aircraft’s ante ie eaaacicsiga 1,7, 10 
normal flight envelope PProP 
: 1, 2, 4, 5, 7, 
Incorrect target intended flight path COHEO TEE OL PHOLGIECE 11 
information Voice message corruption in clearance 5 
Corruption by FIM system 1, 2,4, 11 
Failure to terminate (ie continue to Pilot error 1,2, 7, 12 
Incorrect or : ; 
L follow speed guidance whose display FIM system error Led, Ty 12 
Abnormal : : 
should have been discontinued) 
REV NEW D780-10413-1 Page 39 of 52 


SS 
Q SOEING Honeywell Lehie 


UNITED 


# Hazard sana Form of Hazard Cause a reeauons 
Level (see below) 
Termination Pilot error 1,2,7 
of FIM Early termination FIM system error 1,2,7 
EMI of Certified systems do not provide the Non-certified equipment causes electrical 13 
4 certified L correct information to the flight crew interference 
aircraft 
systems 
Insufficient Pilots not aware of the aircraft state, its | Pilots focus on FIM equipment or Le 
5 cockpit task L relationship to airspace and routes, or procedures and neglect other cockpit duties, 
management the proximity to other aircraft or terrain | including flying the aircraft and scanning 
for other aircraft when in VMC 


Table A.2 provides the risk level (or Risk Assessment Code (RAC) in the NASA process), and is described in greater detail in section 
A.4. The FIM-specific hazards listed above, with hazard number 5 moving from medium to low risk based on mitigations. 


| A (Frequent) B (Occasional) C (Remote) D (Improbable) 


I (Catastrophic) 


Table A.2: Risk Level of FIM-Specific Hazards 


II (Critical) 


Ii (Marginal) 


IV (Negligible) 
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A.2.3 Mitigations 


1. Because inappropriate information has been entered or has resulted from corruption in 
software, the situation does not develop as expected and the flight crew realizes it. 


Prior to the flight test, the crews’ understanding of such expectations will have been refined 
through computer-based and simulator training at NASA Langley. In addition, crews will 
have prior knowledge of the flight identifications and relative positions of flight test aircraft 
for each specific test condition to be flown that day (test cards, cockpit traffic displays, and 
flight test engineers on board). Additionally, the flight test will be flown in low-density 
traffic and has been closely coordinated with the various air traffic control facilities. These 
facilities are accustomed to unusual and flight test type activities. Probability of the use of 
corrupted data is much reduced by the algorithm’s recalculating guidance speed every 
second. Display of corrupted data will, therefore, be extremely transitory. 


2. The controller identifies a pending or actual loss of separation. 


For the flight test, significant coordination has taken place with the ATC facilities concerned, 
and controllers will have been briefed on the intended flight test operations. No change in 
the controllers tasking or workload is expected for this flight test. Controllers in those 
facilities are very familiar with flight test operations of various kinds in the airspace. All 
operations will be conducted under IFR, and crews will be briefed to give absolute priority to 
ATC instructions over flight test needs. Controllers have specified spacing buffers with 
which they are comfortable to assure separation-plus-buffer at merges, and when aircraft are 
following common paths, particularly during the instrument approach procedures. 
Furthermore, each ATC facility will be able to dial into the morning flight briefing, and there 
will be an ATD-1 representative at each facility to answer questions. 


System functionality prevents duplicate aircraft IDs being presented to the pilot. 


4. The potential for an incorrect target’s being or remaining on the entered intended flight path 
is low, resulting in high probability of an alert for lack of lateral conformance and suspension 
of the operation. 


5. Controller error and corruption of data in provision of voice communication is eliminated by 
exclusion of the controller from the FIM-specific data provision function. 


For the flight test, selection of appropriate FIM application information that would, in 
operational conditions, be provided by the controller, will be initiated by the flight crew. All 
information elements will be included in the test card for the specific test condition. These 
information elements include target flight identification, achieve-by point, planned 
termination point and target intended flight path information. An added protection in the 
case of target flight identification selection is that, for all runs, flight crews will choose only 
one of two identifications that will be well known to them. 


6. See 5 above. In the case of the Assigned Spacing Goal, the value will be defined using a 
combination of test card and FIM system information. The test card will define a minimum 
value in terms of time (seconds) or distance (NM) depending on the requirements of the test 
condition, and crews will be trained to adjust spacing to ensure that initiation values of MSI 
or PSI are at or above the minimum values. The FIM system will display current Measured 
Spacing Interval (MSI) or Predicted Spacing Interval (PSI), depending on the clearance type 
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entered into the system. The test card will also define the initiation error value required for 
the specific test condition; the error value will have a positive (+) sign if the value must be 
added to the displayed MSI or PSI, and a negative (-) sign if the error value must be 
subtracted from the displayed MSI or PSI value. Minimum required spacing values will have 
been established at merge points and on common routes, in distance for distance-based 
operations and in a time value that translates to a similar longitudinal distance in time-based 
operations. 


7. Pilots will be concentrating on the flight and test processes with strong emphasis on the FIM 
task, thus reducing the probability of all forms of pilot error that might contribute to the 
hazards. However, to prevent over-concentration on the FIM function to the exclusion of 
other essential operational tasks, each operator’s Crew Resource Management (CRM) 
procedures will be rigorously applied. In particular, one pilot functions as the Pilot 
Monitoring (PM) and does the FIM and FMS data entry, while the other functions as the 
Pilot Flying (PF), maintaining control of the aircraft and scanning visually for other aircraft. 
Each pilot also receives an electronic copy of a FIM user’s manual and is provided with 
access to a computer-based training (CBT) program, as well as a receiving simulator training 
covering both normal and off-nominal operations and equipment failure. This extensive 
training should reduce the amount of time required to enter data and the process to make a 
decision. 


8. Achieve-by Point and Planned Termination Point must be waypoints included in the Intended 
Flight Path Information for target and FIM aircraft if their entry is not to be rejected by the 
system. For many test conditions, lack of a valid Achieve-by Point and Planned Termination 
Point (even the Default value is subject to crew selection) precludes FIM initiation. 


9. The probability of the pilot’s selecting the wrong speed (i.e., not consistent with the speed 
guidance) is not worse than in present-day operations in the same airspace. In many cases, 
the FIM function will alert the pilot to lack of speed conformance, and failure to fly at the 
speed provide by the system will result in a new speed’s being presented. Furthermore, the 
FIM spacing algorithm is also constrained to remain within 15% of the published speed of 
each segment of that arrival or approach procedure, and the flight crew can set the minimum 
speed the spacing algorithm commands based on that aircraft type, weight, and 
environmental conditions. 


10. Aircraft have high and low speed alerting functions to warn crews of excursions outside the 
normal flight envelope, preventing damage caused by excessive speed or loss of control as a 
result of a stall. In addition, flight crews’ airmanship prevents extra-envelope excursions 
when speed instructions are provided by ATC, and the FIM system constraints the speed 
range that can be offered to within the normal flight envelope. 


11. Use of incorrect target or FIM aircraft intended flight path information will result, in many 
cases, in the system’s recognizing that the aircraft is not conforming to the intended path and 
suspending the procedure. 


For the flight test, crews will have prior knowledge of the intended flight path of the target 
aircraft for each test point, and only a limited number of routes will be used, reducing the 
probability of associated error. 
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12. If speed guidance is provided after planned termination on final approach, the crew will 
ignore the guidance either because they know the Planned Termination Point has been passed 
(test card) or because there is a need to begin deceleration to Final Approach Speed. 


For the flight test, crews will have been briefed and trained to discontinue use of speed 
guidance once they determine that adjustment to final approach speed is needed to achieve a 
stabilized approach, regardless of whether the Planned Termination Point has been passed. 


13. Once the prototype systems have been installed on both FIM aircraft, ground testing will 
include checks for radiated frequencies to which on-board systems are known to be sensitive, 
and observation of anomalies that might be associated with EMI from the prototype system. 
Any effects that are considered operationally significant, given the flight test environment, 
will be resolved. Known issues on the 737 flight deck displays with the use of Wi-Fi have 
been avoided by choosing an aircraft in which the issue has already been resolved. 


14. Two EFBs and two CGDs are provided to mitigate the operational effects of failure of one of 
the devices causing an insidious failure not recognizable by the pilots. Furthermore, a 
certified navigation display (ND) and Traffic Alert and Collision Avoidance System (TCAS) 
is available for each pilot to crosscheck the Target information provided by the EFB. 


A.2.4 Operational Effects 


The undesired operational effects of all the hazards range from additional workload for flight 
crew and/or controller at increasing levels, through a reduction in spacing not affecting 
separation, loss of separation and near mid-air collision, to collision. 


The most likely residual operational effect of the hazards is an increase in flight crew workload. 
The flight tests will be carried out in low density airspace using instrument procedures with 
which the crews will be familiar through training and, in the course of the flight test period, 
through experience. Background workload will thus be low compared with operations in busy 
terminal areas. Minor increases in workload associated with the hazards, including increases in 
probability resulting from the use of prototype equipment, will be easily accommodated. Flight 
crews will be briefed to ensure that data entries are correct and system behavior is as expected 
before declaring themselves ready for the next test condition. Holding (as needed) at initiation 
points will allow adequate time for all pre-test activities, including those resulting from 
completion of the preceding test condition and recovery to the start of the next test condition. 


The instrument procedures will be flown as in normal line operations with the exception that 
speed ‘instructions’ will be provided by the FIM system. Crews are accustomed to receiving 
multiple speed instructions from controllers in the course of such operations and in ensuring that 
procedural constraints are respected, so no significant change in workload associated with the 
operational task is postulated. 


The OSA also describes cases in which air traffic controller workload will increase as a result of 
associated hazards’ occurring. Given the low traffic density, the low probability of the hazards’ 
occurring, controllers’ familiarity with the aims of the flight test and of exposure to other flight 
tests, and the reduction in tactical control requirements resulting from the use of FIM, controller 
workload is not expected to be impacted. 
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There are also hazards that may be encountered in everyday commercial air transport operations 
totally independent of FIM operations and flight test. All non-FIM specific hazards are assessed 
to be medium risk. These hazards whose probability is not enhanced nor the severity of the 
operational effect increased by the FIM operation, by the use in the FIM operation of prototype 
equipment, or by virtue of the operations being validation flight tests have not been analyzed, are 


summarized below: 


Table A.3: Air Transport Flight Operations Hazards, Causes and Operational Effects 


Hazard Cause(s) Operational Effect 
CG out of normal Miss-loading; payload Loss of control 
envelope inadequately secured 
Aircraft emergency Engine fire/failure, electrical or ATC to provide priority 
hydraulic malfunction, etc. handling, other aircraft 
directed by ATC to avoid, 


arrival operation not valid as 
ATD-1 scenario (no data) 


Rapid decompression 


System failure; airframe rupture 


Emergency descent 


Failure to conform to 
instrument procedures 


Equipment malfunction; loss of 
situational awareness; excessive 
workload 


Controlled flight into terrain 


Occupants’ emergency 
egress impeded 


Equipment located 
inappropriately 


Unable to exit aircraft in a 
timely fashion following 
incident either before takeoff 
or after landing 


Inadequate equipment 
racks 


Design does not meet regulatory 
requirements resulting in sharp 
edges/corners or rack failure 


Crew injury 


Failure to detect traffic 
conflict 


Loss of crew and/or controller 
traffic situational awareness 


Loss of separation from other 
traffic; near mid-air collision; 
collision 


Meteorological 
conditions acceptability 
criteria not met 


Inaccurate forecast; crew fails to 
follow associated procedures (eg 
anti-icing selection, use of 
turbulence penetration speed) 


Loss of control; aircraft must 
divert 


The above hazards and their associated operational effects are adequately mitigated in the 


following ways: 


e Aircraft model certification and regulatory approval of the flight test configuration 
e Rules of the air (air traffic control regulations, procedures, and minimum separation criteria) 
e Operators’ operating certificate procedures and processes 

e Pilot certification, qualifications, and experience on test aircraft model 
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e Pilots’ initial and recurrent training on model. 


A.4 RISK ASSESSMENT METHODOLOGY 


Each company shall follow their respective FAA mandated and approved safety processes for all 
normal flight operations. This Annex draws on the three safety analysis process described below 
to assess and mitigation operations and events unique to conducting FIM operations. The process 
was used to assign risk assessment codes (RAC) given in Annex A.1 and A.2, is based on: 

o _Honeywell’s Aerospace Flight Test Operations Manual, Chapter 2 (Safety 

Management System) and Chapter 16 (Safety Risk Management), 
o Appendix C of FAA Order 4040.26B (used by UAL for experimental STC), and 
o NASA Langley’s hazard and risk assessment process described in LF273. 


e Hazard Severity: 

I. CATASTROPHIC: death, permanent disability, extended hospitalization, and/or 
equipment damage in excess of $2 million. 

II. CRITICAL: may cause lost-time injury or illness, and/or equipment damage between 
$500,000 and $2 million. 

Ill. MARGINAL: may cause lost-time minor injury or illness, and/or equipment damage 
between $50,000 and $500,000. 
IV. NEGLIGIBLE: may cause non lost-time injury and/or equipment damage between 
$1000 and $50,000. 
e Probability: 

A. FREQUENT: neither safety feature nor approved procedures exist to prevent the 
undesired event from occurring, likely to occur repeatedly during the life cycle of the 
system test or operation. 

B. OCCASIONAL: safety feature does not exist but the use of approved procedures 
should prevent the undesired event from occurring, likely to occur sometime during 
the life cycle of the system test or operation. 

C. REMOTE: approved procedures do not exist but an existing safety feature should 
prevent the undesired event from occurring, may occur during the life cycle of the 
system test or operation. 

D. IMPROBABLE: both a safety feature and approved procedures, or two independent 
safety features exist which, collectively, should prevent the undesired event from 
occurring, likely not to occur during the life cycle of the system test or operation. 


These two parameters are used to assign the risk level (or Risk Assessment Code, RAC) of: 
e High: imperative to suppress risk to a lower level 
e Medium: a waiver is required to conduct operations 
e Low: the flight operation permissible following review and approval 
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The following table provides the correlation of severity and probability to the RAC: 


Table A.4: RAC by Severity and Probability 


A (Frequent) B (Occasional) C (Remote) D (Improbable) 


I (Catastrophic) 


II (Critical) 


I (Marginal) 


IV (Negligible) 
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Annex B. Honeywell Hazard Identification Form 


Annex B is an extract from the Honeywell Aerospace Flight Test Operations Manual, and retains 
the paragraph numbering to allow cross-referencing of the document. The two documents and 
their associated process defined by Honeywell will be used by the ATD-1 Flight Test team to 
identify and mitigate hazards discovered during the conduct of the flight test and are not 
discussed in Annex A. Blank copies and all completed versions of the documents will be 
maintained the Flight Test Director and the NASA Flight Test Lead. 


B.1 18.4 Hazard Identification 


Instructions for Hazard Identification Form 18.4 

The purpose of the Hazard Identification Form is to identify potential flight test hazards and/or 
report hazardous events, which have occurred in the past. The process of completing this form is 
to describe the potential hazard and/or report an event, provide a brief analytical summary, 
propose remedial actions and have management either accept or reject the proposal. 


In case the proposed remedial action is rejected, management should explain the reasons for 
rejection and offer alternative actions if applicable. Each entry on the Hazard Identification Form 
is explained on page 10b — 10c 


B.2 18.5 Hazard / Risk Management Tracking 


Instructions for Hazard / Risk Management Tracking Form 18.5 

The Hazard / Risk Management Tracking Form serves as a listing of hazards and risks, which 
have not been itemized in Chapter 18 Appendix B SMS/Safety Risk Management, Chapter 18.3 
Identified Hazard Listing. 


If the remedial actions were accepted, the Hazard / Risk Management Tracking Form tracks 
implementation and prompts a review of the remedial actions. 


The Form tracks all reported hazards, whether substantiated or perceived, even if remedial 
actions were rejected. However, only those identified hazards that have an accepted remedial 


action will be implemented and reviewed. 


If the review validates the hazard it should be adopted into Chapter 18.3 Identified Hazard 
Listing. 
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18.4 Hazard Identification Form Report Number.__ 


Describe the event you observed: 


Location: 


Name: : : Date: 


Phone Number: 


Summary of Analyses 


© 


Propose Remedial Action ~C) 


Accepted O Rejected O If rejected, explain reason and proposed alternative action. 


Chief Pilot / Site Leader: A)... 


Remedial Action Implemented 


Post Implementation Review conducted by 


Figure 4: 18.4 Hazard Identification Form 
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18.4 Hazard Identification Form 


= Hazard Identification Report number Form 184 
= Report Number consists of consecutive numbers from 001 to 999, preceded by 


the 2-digits of the year, For Example: 16.001 


= Insert factual description of the event observed 


= Insert Date, Time and location of the event 

= Enter Name of person submitting report. Include date and phone number 

= Provide a brief analysis, descnbing possible / actual observed hazards 

= Enter name of person submitting analysis and date 

Enter recommended remedial action, designed to avoid reoccurrence or potential 


future occurrence 


= Check mark if proposed remedial action is either accepted or rejected by Chief 
Pilot / Site Leader. 


= State reason if proposed remedial actions were rejected. 
= Enter name of Chief Pilot / Site Leader and date 
= Enter date when remedial action was implemented 


= Enter date when remedial action was reviewed 


© OOOOOOOOOOWO) 


Figure 5: 18.4 Hazard Identification Form 
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Honeywell Aerospace Flight Test Operations Manual (1), 


18.5 Hazard / Risk Management Tracking Form From: To: 


Date Propose Remedial Action 
Imple- ; 
Accepted | mented 


Revision: 6 Pg. 18-114 


Figure 6: 18.5 Hazard/Risk Management Tracking Form 
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18.5 Hazard / Risk Management Tracking Form 


From: Enter date of first row entry, To: Enter date of last row entry 

= Report Number: YYXXX... [YY = Last two digits of the year of the event. XXX = 3 digits, starting with 001, adding 1 
for each new event until the end of that event year; e.g. 16001, 16002, 16003, ... 17001, 17002...,etc.] 

= Select functional category from drop down Table: EN = Engineering, FO = Flight Operations, GS = Ground Support, MX 
= Maintenance, OTH = Other. 

= Insert date when event was reported 

= Brief description of the Hazard / Risk 

Select Risk Level from Drop Down Table: L = Low, M = Medium, H = High 


= Brief description of proposed remedial action 


= Date the remedial action was accepted by Site Leader / Chief Pilot 


= Date the remedial action was implemented 


= Date the remedial action was reviewed 


QBOOO OOOO OO 


Figure 7: 18.5 Hazard/Risk Management Tracking Form 
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Annex C. Contingency Response Checklist 


Based on section 4.4, Annex C provides a checklist of action items to be accomplished in 
response to a contingency. The procedures of that aircraft’s operator (Honeywell or United 
Airlines) will be utilized, and the operator would investigate any non-NASA, non-FAA/NTSB 
mishap and cooperate fully with other investigating agencies. 


The ATD-1 Flight Test Director has the primary responsibility to communicate with all 
participants as soon as possible. The Flight Test Director may enlist support from the NASA 
Flight Test Lead to expedite the communication. 


OFA | 


C.2 


C.3 


C.4 


Organizations and their contact information 
Honeywell Flight Safety Officer, Helmuth Eggeling, 602-231-2697 or 602-363-9316 
United Airlines Project Manager, Craig Stankiewicz, 872-825-9110 or 847-567-3864 
NASA Langley Aviation Manager, Shane Dover, 757-864-7700 

o Backup: Flight Safety Officer, Greg Slover, 757-864-8135 or 757-751-2851 
Seattle ARTCC (ZSE), Leon Fullner, Support Manager, 253-351-3620 
Seattle TRACON, Tod Thomas, Air Traffic Manager, 206-241-4601 
Moses Lake TRACON, Debra Hernke, Air Traffic Manager, 509-762-1367 


Definitions (extract from NPR 8621.1C, paragraph 1.1) 


Mishap: injury or illness caused by NASA operations, destruction of property 
caused by NASA-funded operations. 

Close Call: no injury or only minor injury, damage less than $20,000 to 
equipment and property, but which possesses the potential to cause a mishap. 

Not a NASA mishap or close call: accidents involving aircraft operated as civil 
use, owned by civil operators, and accomplishing missions for NASA where there 
is no NASA property damage or Federal employee injury. 


Suggested Mishap and Close Call report format (extract from LMS-OP-0939) 


Aircraft type and tail number 

Personnel involved and injuries 
Accident description 

Accident site 

Current condition of the site 

Time of accident 

Your name, phone number, and location 


Other considerations 

Participants should make a written record of the event and provide it to the investigation 
board if requested 

Flight Test Director and Flight Test Lead with support from flight crews to determine 
corrective action; notify all flight operations and NASA flight safety officer of update 
Notify the LaRC IRB and the JSC IRB if issue relevant to the safety of human subjects 
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